PatchTheCVEnc-cms vulnerabilities and fixes
Recent CVEs affecting nc-cms, with upgrade or downgrade steps. 4 tracked.
Also searched as: nc cms.
nc-cms has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2019-02-11. Highest priority: CVE-2018-18874 (score 65/100).
- CVE-2019-7721 HIGH 7.5 DOWNGRADE lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordat
- CVE-2018-18874 CRITICAL 9.8 UPGRADE nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image"
- CVE-2018-18361 MEDIUM 6.1 UPGRADE An issue was discovered in nc-cms through 2017-03-10
- CVE-2018-18290 MEDIUM 4.8 UPGRADE An issue was discovered in nc-cms through 2017-03-10
FAQ
How do I fix nc-cms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is nc-cms being exploited right now?
None of the tracked nc-cms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which nc-cms CVE should I patch first?
CVE-2018-18874 currently ranks highest (65/100): nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image".